code-review
Review code for quality, security, and best practices. Use for PR reviews, code quality checks, security audits, and pre-merge reviews.
When & Why to Use This Skill
This Claude skill automates the code review process by systematically analyzing source code for logic correctness, security vulnerabilities, and adherence to industry best practices. It streamlines the development lifecycle by providing structured feedback on performance, readability, and test coverage, ensuring high-quality and secure software delivery while reducing the manual burden on senior developers.
Use Cases
- Automated Pull Request (PR) Reviews: Integrate into the CI/CD pipeline to automatically scan incoming code changes for bugs and style violations before human review.
- Security Vulnerability Auditing: Identify critical security flaws such as SQL injection, XSS, and hardcoded secrets based on OWASP Top 10 standards to prevent data breaches.
- Technical Debt Reduction: Evaluate existing codebases for code duplication (DRY principle), poor naming conventions, and architectural inconsistencies to improve long-term maintainability.
- TypeScript Type Safety Enforcement: Ensure robust type annotations and proper null/undefined handling in TypeScript projects to minimize runtime errors.
- Performance and Resource Optimization: Detect inefficient logic, N+1 query patterns, and potential memory leaks to ensure applications remain fast and scalable.
| name | code-review |
|---|---|
| description | Review code for quality, security, and best practices. Use for PR reviews, code quality checks, security audits, and pre-merge reviews. |
| allowed-tools | Read, Grep, Glob, Bash |
Code Review Skill
Systematic code review for quality, security, and maintainability.
Review Checklist
1. Correctness
- Logic is correct
- Edge cases handled
- Error handling appropriate
- No obvious bugs
2. Security (OWASP Top 10)
- No SQL injection vulnerabilities
- No XSS vulnerabilities
- Input validation present
- No hardcoded secrets
- Authentication/authorization correct
- Sensitive data protected
3. Code Quality
- Code is readable
- Functions are focused (single responsibility)
- No code duplication (DRY)
- Naming is clear and consistent
- No magic numbers/strings
- Appropriate comments where needed
4. TypeScript Specifics
- No
anytypes - Proper type annotations
- Null/undefined handled
- Generics used appropriately
5. Performance
- No obvious performance issues
- No N+1 queries
- Appropriate caching
- Memory leaks avoided
6. Testing
- Tests exist for new code
- Tests are meaningful
- Edge cases tested
- Coverage maintained
Output Format
Critical (Must Fix)
Issues that must be fixed before merge.
CRITICAL: [file:line] - [Issue description]
Code: `problematic code`
Fix: [Suggested fix]
Warnings (Should Fix)
Issues that should be addressed but don't block merge.
WARNING: [file:line] - [Issue description]
Suggestion: [Improvement]
Suggestions (Consider)
Nice-to-have improvements.
SUGGESTION: [file:line] - [Improvement idea]
Summary
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CODE REVIEW SUMMARY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Files reviewed: X
Critical issues: X
Warnings: X
Suggestions: X
Verdict: [APPROVED / CHANGES REQUESTED]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━